Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Antimalware Doctor entfernt aber weitere Probleme (https://www.trojaner-board.de/90680-antimalware-doctor-entfernt-probleme.html)

Bergamo 12.09.2010 12:00
Antimalware Doctor entfernt aber weitere Probleme
 
Hi,
ich habe mir den Antimalware Doctor eingefangen und nach der Anleitung hier im Forum zumindest oberflächlich entfernt.
Jetzt sind mir aber ein paar Sachen aufgefallen und ich glaube mein Rechner ist noch nicht sauber:
- IE und Windows Live Messenger bekommen keine Verbindung zum Internet, Firefox geht aber
-Antivir lässt sich nicht updaten
-AdAware lässt sich nicht installieren oder deinstallieren (beim Versuch alles manuell zu löschen kann die Datei ShellExt.dll nicht gelöscht werden)
-daraufhin der Versuch Spybot S&D zu installieren, geht aber auch nicht, kann keine Verbindung zum Internet herstellen
-Malwarebytes' Anti-Malware meldet immer weitere Funde

hier noch die Logfiles mit Funden von Anti-Malware sowie hijackthis

Ich hoffe es klann mir jemand weiterhelfen um eine Neuinstallation zu umgehen!

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4557

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

07.09.2010 00:16:20
mbam-log-2010-09-07 (00-16-20).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 155101
Laufzeit: 19 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mediafix70700en02.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajxnkopp (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajxnkopp (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\***\Anwendungsdaten\6DF4266474A69BF700722E1DC89FC357\mediafix70700en02.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\wxpbbvepm\doaqkhhuqiw.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Drivers\kppvacny.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\mkcxhunr.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\96.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\98.tmp (Rootkit.Dropper) -> Quarantined and deleted successfully.
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4557

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

07.09.2010 10:24:57
mbam-log-2010-09-07 (10-24-57).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 78690
Laufzeit: 2 Stunde(n), 9 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{349BF539-D81E-4901-B9E7-E40F5CE19BE1}\RP1\A0001007.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4583

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

09.09.2010 19:09:45
mbam-log-2010-09-09 (19-09-45).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 155479
Laufzeit: 22 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acexmwonsr.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\acexmwonsr.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4594

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11.09.2010 21:23:23
mbam-log-2010-09-11 (21-23-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 247595
Laufzeit: 2 Stunde(n), 16 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6FW72PCL\mediafix70700en02[1].exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6FW72PCL\cgbvd[1].htm (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDWBKVMH\nezgb[2].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDWBKVMH\qhysq[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OLYZCLQ7\cgbvd[1].htm (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:11:10, on 12.09.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Logitech\QuickCam\Quickcam.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\QuickTime\QTTask.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\phonostar\ps_timer.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\slrundll.exe
C:\Dokumente und Einstellungen\***\Desktop\HiJackThis204.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6092
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Asz.Citavi.IEPicker.IEPickerButton - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhonostarTimer] C:\Programme\phonostar\ps_timer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Citavi Picker... - file://C:\Programme\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Citavi Picker - {619D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9131 bytes

kira 13.09.2010 07:05
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
1.
- Lade dir RSIT - http://filepony.de/download-rsit/:
- an einen Ort deiner Wahl und führe die rsit.exe aus
- wird "Hijackthis" auch von Rsit installiert und ausgeführt
- RSIT erstellt 2 Logfiles (C:\rsit\log.txt und C:\rsit\info.txt) mit erweiterten Infos von deinem System - diese beide bitte komplett hier posten

2.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

3.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool "Ccleaner" herunter
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

5.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!

6.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Lade und installiere das Tool RootRepeal herunter
  • setze einen Hacken bei: "Drivers"-> "Scan"-> Save Report"...
  • "Stealth Objects" -> "Scan"-> Save Report"...
  • "Hidden Services" -> "Scan"-> Save Report"...
  • speichere das Logfile als "RootRepeal.txt" auf dem Desktop und Kopiere den Inhalt hier in den Thread

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
Coverflow

Bergamo 13.09.2010 21:40
Hallo,
here we are! Ich hoffe das hilft dir weiter...

1.
geht nicht
Fehlermeldung:
Line 3601 (File"C:\...)

Error: Subscript used with non-Array variable

2.
ok!

3.
angehängt!

4.
Code:
Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        10.0.32.18
Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        10.1.82.76
Adobe Reader 7.0.5 Language Support        Adobe Systems        7.0.5
Adobe Reader 7.1.0 - Deutsch        Adobe Systems Incorporated        7.1.0
Apple Application Support        Apple Inc.        1.1.0
Apple Software Update        Apple Inc.        2.1.1.116
ATI - Dienstprogramm zur Deinstallation der Software                6.14.10.1009
ATI Catalyst Control Center                1.2.2128.637
ATI Control Panel                6.14.10.5113
ATI Display Driver                8.03-040610a-016676C
Avira AntiVir Personal - Free Antivirus        Avira GmbH       
Benutzerhandbuch für Creative Live! Cam Vista IM (Deutsch)               
CCleaner        Piriform        2.35
Cinergy XS Series V5.09.0304.00a                5.09.0304.00a
Cisco Systems VPN Client 5.0.03.0560        Cisco Systems, Inc.        5.0.3
Citavi 2.4.9.0        Academic Software Zurich        2.4.9.0
CloneDVD2        Elaborate Bytes       
Creative-Systeminformationen               
Deutsche Sprachdatei für Winamp 5.02 v14               
DivX Codec        DivX, Inc.        6.8.5
DivX Converter        DivX, Inc.        7.1.0
DivX Player        DivX, Inc.        7.2.0
DivX Plus DirectShow Filters        DivX, Inc.       
DivX Web Player        DivX,Inc.        1.5.0
Dropbox                0.7.110
FastStone Image Viewer 2.6 Beta 3        FastStone Soft.        2.6 Beta 3
FLIQLO Screen Saver               
Free YouTube to Mp3 Converter version 3.1        DVD Video Soft Limited.       
Google Earth        Google        4.2.205.5730
GPL Ghostscript 8.61               
GPL Ghostscript Fonts               
GSview 4.9               
High Definition Audio Driver Package - KB835221        Microsoft Corporation        20040219.000000
HP Smart Web Printing        HP        3.5
HP Update        Hewlett-Packard        4.000.007.003
ICQ7.2        ICQ        7.2
InterVideo WinDVD        InterVideo Inc.        5.0-B11.581
iTunes        Apple Computer, Inc.        6.0.4.2
J2SE Runtime Environment 5.0 Update 11        Sun Microsystems, Inc.        1.5.0.110
Java 2 Runtime Environment, SE v1.4.2_05        Sun Microsystems, Inc.        1.4.2_05
Java(TM) 6 Update 17        Sun Microsystems, Inc.        6.0.170
LiveUpdate 1.90 (Symantec Corporation)        Symantec Corporation        1.90.15.0
Logitech QuickCam        Logitech Inc.        11.70.1200
Logitech QuickCam-Treiberpaket               
Logitech Updater        Ihr Firmenname        1.70
Malwarebytes' Anti-Malware        Malwarebytes Corporation       
Microsoft .NET Framework 1.0 Hotfix (KB953295)        Microsoft Corporation       
Microsoft .NET Framework 1.0 Hotfix (KB979904)        Microsoft Corporation       
Microsoft .NET Framework 1.1               
Microsoft .NET Framework 1.1 German Language Pack        Microsoft        1.1.4322
Microsoft .NET Framework 2.0 Service Pack 2        Microsoft Corporation        2.2.30729
Microsoft .NET Framework 3.0 Service Pack 2        Microsoft Corporation        3.2.30729
Microsoft .NET Framework 3.5 SP1        Microsoft Corporation       
Microsoft Office Enterprise 2007        Microsoft Corporation        12.0.6425.1000
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        8.0.56336
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148        Microsoft Corporation        9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022        Microsoft Corporation        9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        9.0.30729
MiniBHKW-Plan_Ausbildung Version 2.04        Steinborn innovative Gebäude-Energieversorgung       
Mozilla Firefox (3.0.19)        Mozilla        3.0.19 (de)
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        4.20.9870.0
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        4.20.9876.0
Nero OEM               
NeroVision Express 2               
O2Micro MemoryCardBus Windows Driver        O2Micro Electronics, Inc.        1.50.0000
PDF Blender               
PDFCreator        Frank Heindörfer, Philip Chinery        0.9.1
phonostar-Player Version 1.52.7               
QuickTime        Apple Inc.        7.65.17.80
RealPlayer               
REALTEK Gigabit and Fast Ethernet NIC Driver        REALTEK Semiconductor Corp.        1.50
Skype™ 4.2        Skype Technologies S.A.        4.2.169
Smart Link 56K Modem               
Soldier of Fortune               
Synaptics Pointing Device Driver                7.10.10.0
Uninstall 1.0.0.1               
VIA Audio Driver Setup Program               
Winamp (remove only)               
Windows Internet Explorer 8        Microsoft Corporation        20090308.140743
Windows Live Anmelde-Assistent        Microsoft Corporation        5.000.818.5
Windows Live Essentials        Microsoft Corporation        14.0.8089.0726
Windows Live-Uploadtool        Microsoft Corporation        14.0.8014.1029
Windows XP Service Pack 3        Microsoft Corporation        20080414.031514
WinRAR Archivierer
5.
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-13 21:10:19
Windows 5.1.2600 Service Pack 3
Running: bv97wq31.exe; Driver: C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\kxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT            F8CA1B56                                                                                                                                              ZwCreateKey
SSDT            F8CA1B4C                                                                                                                                              ZwCreateThread
SSDT            F8CA1B5B                                                                                                                                              ZwDeleteKey
SSDT            F8CA1B65                                                                                                                                              ZwDeleteValueKey
SSDT            F8CA1B6A                                                                                                                                              ZwLoadKey
SSDT            F8CA1B38                                                                                                                                              ZwOpenProcess
SSDT            F8CA1B3D                                                                                                                                              ZwOpenThread
SSDT            F8CA1B74                                                                                                                                              ZwReplaceKey
SSDT            F8CA1B6F                                                                                                                                              ZwRestoreKey
SSDT            F8CA1B60                                                                                                                                              ZwSetValueKey
SSDT            F8CA1B47                                                                                                                                              ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

init            C:\WINDOWS\system32\drivers\o2mmb.sys                                                                                                                  entry point in "init" section [0xF7385320]
.rsrc          C:\WINDOWS\system32\DRIVERS\redbook.sys                                                                                                                entry point in ".rsrc" section [0xF86D0F94]

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\System32\svchost.exe[1508] USER32.dll!GetCursorPos                                                                                          7E37974E 5 Bytes  JMP 00E0000A
.text          C:\WINDOWS\System32\svchost.exe[1508] ole32.dll!CoCreateInstance                                                                                      774D057E 5 Bytes  JMP 00DF000A

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Dokumente und Einstellungen\***\Desktop\bv97wq31.exe[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]                        [00802F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Dokumente und Einstellungen\***\Desktop\bv97wq31.exe[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                [00802CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Dokumente und Einstellungen\***\Desktop\bv97wq31.exe[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                              [00802D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Dokumente und Einstellungen\***\Desktop\bv97wq31.exe[376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                    [00802CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\Explorer.EXE[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                              [01542F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\Explorer.EXE[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                                      [01542CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\Explorer.EXE[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                                                                    [01542D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\Explorer.EXE[812] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                                          [01542CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]          [00AD2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [00AD2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                [00AD2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [00AD2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Logitech\QuickCam\Quickcam.exe[1920] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                          [01C72F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Logitech\QuickCam\Quickcam.exe[1920] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [01C72CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Logitech\QuickCam\Quickcam.exe[1920] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                                              [01C72D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Logitech\QuickCam\Quickcam.exe[1920] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [01C72CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]                      [00A32F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]            [00A32CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                          [00A32D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2240] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                [00A32CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\system32\slrundll.exe[4036] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                    [00802F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\system32\slrundll.exe[4036] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                            [00802CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\system32\slrundll.exe[4036] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose]                                                          [00802D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\WINDOWS\system32\slrundll.exe[4036] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                                [00802CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                                SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                                SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          -> \Driver\atapi \Device\Harddisk0\DR0                                                                                                                82CDEEC5

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\system32\DRIVERS\redbook.sys                                                                                                                suspicious modification
File            C:\WINDOWS\system32\drivers\atapi.sys                                                                                                                  suspicious modification

---- EOF - GMER 1.0.15 ----
6.
Code:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:                2010/09/13 21:47
Program Version:                Version 1.3.5.0
Windows Version:                Windows XP Media Center Edition SP3
==================================================

Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS
Address: 0xF85D5000        Size: 57344        File Visible: -        Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF8565000        Size: 188800        File Visible: -        Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000        Size: 2192256        File Visible: -        Signed: -
Status: -

Name: ACPIEC.sys
Image Path: ACPIEC.sys
Address: 0xF89D1000        Size: 12160        File Visible: -        Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xB26E9000        Size: 138496        File Visible: -        Signed: -
Status: -

Name: agp440.sys
Image Path: agp440.sys
Address: 0xF8635000        Size: 42368        File Visible: -        Signed: -
Status: -

Name: arp1394.sys
Image Path: C:\WINDOWS\system32\DRIVERS\arp1394.sys
Address: 0xF87F5000        Size: 60800        File Visible: -        Signed: -
Status: -

Name: asyncmac.sys
Image Path: C:\WINDOWS\system32\DRIVERS\asyncmac.sys
Address: 0xB1C44000        Size: 14336        File Visible: -        Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xF84D9000        Size: 96512        File Visible: -        Signed: -
Status: -

Name: ati2cqag.dll
Image Path: C:\WINDOWS\System32\ati2cqag.dll
Address: 0xBF049000        Size: 229376        File Visible: -        Signed: -
Status: -

Name: ati2dvag.dll
Image Path: C:\WINDOWS\System32\ati2dvag.dll
Address: 0xBF012000        Size: 225280        File Visible: -        Signed: -
Status: -

Name: ati2mtag.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
Address: 0xF73FE000        Size: 860160        File Visible: -        Signed: -
Status: -

Name: ati3duag.dll
Image Path: C:\WINDOWS\System32\ati3duag.dll
Address: 0xBF081000        Size: 2158592        File Visible: -        Signed: -
Status: -

Name: ativvaxx.dll
Image Path: C:\WINDOWS\System32\ativvaxx.dll
Address: 0xBF290000        Size: 520192        File Visible: -        Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000        Size: 286720        File Visible: -        Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys
Address: 0xF8B9D000        Size: 3072        File Visible: -        Signed: -
Status: -

Name: avgio.sys
Image Path: C:\Programme\Avira\AntiVir Desktop\avgio.sys
Address: 0xF8B63000        Size: 6144        File Visible: -        Signed: -
Status: -

Name: avgntflt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys
Address: 0xB1C7C000        Size: 81920        File Visible: -        Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xB256C000        Size: 114688        File Visible: -        Signed: -
Status: -

Name: BATTC.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS
Address: 0xF89CD000        Size: 16384        File Visible: -        Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF8B5B000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF89C5000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xF86D5000        Size: 63744        File Visible: -        Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys
Address: 0xF86B5000        Size: 62976        File Visible: -        Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Address: 0xF8615000        Size: 53248        File Visible: -        Signed: -
Status: -

Name: CmBatt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\CmBatt.sys
Address: 0xF8A59000        Size: 13952        File Visible: -        Signed: -
Status: -

Name: compbatt.sys
Image Path: compbatt.sys
Address: 0xF89C9000        Size: 10240        File Visible: -        Signed: -
Status: -

Name: CVPNDRVA.sys
Image Path: C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
Address: 0xB144C000        Size: 589824        File Visible: -        Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xF8605000        Size: 36352        File Visible: -        Signed: -
Status: -

Name: dmio.sys
Image Path: dmio.sys
Address: 0xF84F1000        Size: 154112        File Visible: -        Signed: -
Status: -

Name: dmload.sys
Image Path: dmload.sys
Address: 0xF8ABB000        Size: 5888        File Visible: -        Signed: -
Status: -

Name: dne2000.sys
Image Path: C:\WINDOWS\system32\DRIVERS\dne2000.sys
Address: 0xF6FEA000        Size: 119936        File Visible: -        Signed: -
Status: -

Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xF7560000        Size: 61440        File Visible: -        Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xF6F6E000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF000000        Size: 73728        File Visible: -        Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF8C3C000        Size: 4096        File Visible: -        Signed: -
Status: -

Name: ElbyCDIO.sys
Image Path: C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
Address: 0xF8865000        Size: 16896        File Visible: -        Signed: -
Status: -

Name: ElbyDelay.sys
Image Path: C:\WINDOWS\System32\Drivers\ElbyDelay.sys
Address: 0xF8AED000        Size: 4608        File Visible: -        Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xF87D5000        Size: 44672        File Visible: -        Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xF84B9000        Size: 129792        File Visible: -        Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF8B59000        Size: 7936        File Visible: -        Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF8517000        Size: 126336        File Visible: -        Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys
Address: 0xF8925000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806EF000        Size: 81152        File Visible: -        Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS
Address: 0xF86E5000        Size: 36864        File Visible: -        Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS
Address: 0xF89AD000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys
Address: 0xF6F8E000        Size: 10368        File Visible: -        Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys
Address: 0xB0CFD000        Size: 265728        File Visible: -        Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys
Address: 0xF8695000        Size: 52992        File Visible: -        Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys
Address: 0xF86A5000        Size: 42112        File Visible: -        Signed: -
Status: -

Name: intelide.sys
Image Path: intelide.sys
Address: 0xF8AB9000        Size: 5504        File Visible: -        Signed: -
Status: -

Name: intelppm.sys
Image Path: C:\WINDOWS\system32\DRIVERS\intelppm.sys
Address: 0xF8675000        Size: 40448        File Visible: -        Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys
Address: 0xB2628000        Size: 152832        File Visible: -        Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys
Address: 0xB278C000        Size: 75264        File Visible: -        Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF85B5000        Size: 37632        File Visible: -        Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys
Address: 0xF8915000        Size: 25216        File Visible: -        Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF8AB5000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xB040F000        Size: 172416        File Visible: -        Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys
Address: 0xF7117000        Size: 143360        File Visible: -        Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF8490000        Size: 92928        File Visible: -        Signed: -
Status: -

Name: kxtdypow.sys
Image Path: C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\kxtdypow.sys
Address: 0xB043A000        Size: 93056        File Visible: No        Signed: -
Status: -

Name: LVPr2Mon.sys
Image Path: C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
Address: 0xF88B5000        Size: 18944        File Visible: -        Signed: -
Status: -

Name: MbxStby.sys
Image Path: C:\WINDOWS\system32\drivers\MbxStby.sys
Address: 0xF8AE9000        Size: 6016        File Visible: -        Signed: -
Status: -

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xF8B5D000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: Modem.SYS
Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS
Address: 0xF895D000        Size: 30336        File Visible: -        Signed: -
Status: -

Name: MODEMCSA.sys
Image Path: C:\WINDOWS\system32\drivers\MODEMCSA.sys
Address: 0xF8A91000        Size: 16128        File Visible: -        Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys
Address: 0xF891D000        Size: 23552        File Visible: -        Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mouhid.sys
Address: 0xF6F8A000        Size: 12288        File Visible: -        Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF85E5000        Size: 42368        File Visible: -        Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mrxdav.sys
Address: 0xB175C000        Size: 180608        File Visible: -        Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
Address: 0xB264E000        Size: 455680        File Visible: -        Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xF89BD000        Size: 19072        File Visible: -        Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys
Address: 0xF8725000        Size: 35072        File Visible: -        Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys
Address: 0xF8A79000        Size: 15488        File Visible: -        Signed: -
Status: -

Name: Mtlmnt5.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
Address: 0xF7008000        Size: 126656        File Visible: -        Signed: -
Status: -

Name: Mtlstrm.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
Address: 0xB080E000        Size: 1309088        File Visible: -        Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xF83BC000        Size: 105344        File Visible: -        Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF83D6000        Size: 182656        File Visible: -        Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys
Address: 0xF8A65000        Size: 10112        File Visible: -        Signed: -
Status: -

Name: ndisuio.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Address: 0xB1C40000        Size: 14592        File Visible: -        Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys
Address: 0xF6FD3000        Size: 91520        File Visible: -        Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF8785000        Size: 40576        File Visible: -        Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys
Address: 0xF87C5000        Size: 34688        File Visible: -        Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys
Address: 0xB270B000        Size: 162816        File Visible: -        Signed: -
Status: -

Name: nic1394.sys
Image Path: C:\WINDOWS\system32\DRIVERS\nic1394.sys
Address: 0xF8685000        Size: 61824        File Visible: -        Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xF8855000        Size: 30848        File Visible: -        Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF8403000        Size: 574976        File Visible: -        Signed: -
Status: -

Name: ntoskrnl.exe
Image Path: C:\WINDOWS\system32\ntoskrnl.exe
Address: 0x804D7000        Size: 2192256        File Visible: -        Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xF8B8E000        Size: 2944        File Visible: -        Signed: -
Status: -

Name: o2mmb.sys
Image Path: C:\WINDOWS\system32\drivers\o2mmb.sys
Address: 0xF7385000        Size: 191040        File Visible: -        Signed: -
Status: -

Name: ohci1394.sys
Image Path: ohci1394.sys
Address: 0xF85C5000        Size: 61696        File Visible: -        Signed: -
Status: -

Name: OPRGHDLR.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
Address: 0xF8B7E000        Size: 4096        File Visible: -        Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF883D000        Size: 19712        File Visible: -        Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xF8554000        Size: 68224        File Visible: -        Signed: -
Status: -

Name: pciide.sys
Image Path: pciide.sys
Address: 0xF8B7D000        Size: 3328        File Visible: -        Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Address: 0xF8835000        Size: 28672        File Visible: -        Signed: -
Status: -

Name: pcmcia.sys
Image Path: pcmcia.sys
Address: 0xF8536000        Size: 120576        File Visible: -        Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000        Size: 2192256        File Visible: -        Signed: -
Status: -

Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xF708A000        Size: 147456        File Visible: -        Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys
Address: 0xF6FC2000        Size: 69120        File Visible: -        Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys
Address: 0xF8975000        Size: 17792        File Visible: -        Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF8625000        Size: 36320        File Visible: -        Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys
Address: 0xF837C000        Size: 8832        File Visible: -        Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
Address: 0xF86F5000        Size: 51328        File Visible: -        Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys
Address: 0xF8705000        Size: 41472        File Visible: -        Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys
Address: 0xF8715000        Size: 48384        File Visible: -        Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys
Address: 0xF897D000        Size: 16512        File Visible: -        Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000        Size: 2192256        File Visible: -        Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys
Address: 0xB26BE000        Size: 175744        File Visible: -        Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF8B5F000        Size: 4224        File Visible: -        Signed: -
Status: -

Name: rdpdr.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rdpdr.sys
Address: 0xF6F92000        Size: 196224        File Visible: -        Signed: -
Status: -

Name: RecAgent.sys
Image Path: RecAgent.sys
Address: 0xF89D5000        Size: 13696        File Visible: -        Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys
Address: 0xF86C5000        Size: 57728        File Visible: -        Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB0FDD000        Size: 49152        File Visible: No        Signed: -
Status: -

Name: Rtlnicxp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
Address: 0xF73B4000        Size: 70144        File Visible: -        Signed: -
Status: -

Name: slntamr.sys
Image Path: C:\WINDOWS\system32\DRIVERS\slntamr.sys
Address: 0xF7027000        Size: 404960        File Visible: -        Signed: -
Status: -

Name: Slnthal.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Slnthal.sys
Address: 0xB07F6000        Size: 95360        File Visible: -        Signed: -
Status: -

Name: SlWdmSup.sys
Image Path: C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
Address: 0xF7AFC000        Size: 13152        File Visible: -        Signed: -
Status: -

Name: sr.sys
Image Path: sr.sys
Address: 0xF84A7000        Size: 73472        File Visible: -        Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys
Address: 0xB1305000        Size: 354304        File Visible: -        Signed: -
Status: -

Name: ssmdrv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
Address: 0xF885D000        Size: 23040        File Visible: -        Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys
Address: 0xF8B3D000        Size: 4352        File Visible: -        Signed: -
Status: -

Name: SynTP.sys
Image Path: C:\WINDOWS\system32\DRIVERS\SynTP.sys
Address: 0xF713A000        Size: 182688        File Visible: -        Signed: -
Status: -

Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xF8765000        Size: 60800        File Visible: -        Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys
Address: 0xB2733000        Size: 361600        File Visible: -        Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS
Address: 0xF896D000        Size: 20480        File Visible: -        Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys
Address: 0xF8735000        Size: 40704        File Visible: -        Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\system32\DRIVERS\update.sys
Address: 0xF6F0C000        Size: 384768        File Visible: -        Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS
Address: 0xF8AEB000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys
Address: 0xF890D000        Size: 30208        File Visible: -        Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys
Address: 0xF87B5000        Size: 59520        File Visible: -        Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS
Address: 0xF73C6000        Size: 147456        File Visible: -        Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbuhci.sys
Address: 0xF8905000        Size: 20608        File Visible: -        Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF89B5000        Size: 20992        File Visible: -        Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS
Address: 0xF73EA000        Size: 81920        File Visible: -        Signed: -
Status: -

Name: vinyl97.sys
Image Path: C:\WINDOWS\system32\drivers\vinyl97.sys
Address: 0xF70AE000        Size: 159488        File Visible: -        Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF85F5000        Size: 53760        File Visible: -        Signed: -
Status: -

Name: w29n51.sys
Image Path: C:\WINDOWS\system32\DRIVERS\w29n51.sys
Address: 0xF7167000        Size: 2216064        File Visible: -        Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys
Address: 0xF87E5000        Size: 34560        File Visible: -        Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xF887D000        Size: 20480        File Visible: -        Signed: -
Status: -

Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xB19E7000        Size: 83072        File Visible: -        Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000        Size: 1855488        File Visible: -        Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000        Size: 1855488        File Visible: -        Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS
Address: 0xF8AB7000        Size: 8192        File Visible: -        Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000        Size: 2192256        File Visible: -        Signed: -
Status: -
Stealth objects: Keine Funde
Hidden objects: Fehlermeldung
Could not read system registry!
Please contact the author!

kira 14.09.2010 20:17
"RSIT" könntest nicht installieren?

lade Dir HijackThis 2.0.4 von *von hier* herunter
HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen"

Bergamo 14.09.2010 21:41
Ich kann es installieren aber der RSIT scan läuft nicht durch sondern wird abgebrochen!

Hier HijackThis

Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:37:00, on 14.09.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Logitech\QuickCam\Quickcam.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\QuickTime\QTTask.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\phonostar\ps_timer.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Java\jre6\bin\javaw.exe
C:\WINDOWS\System32\svchost.exe
C:\Dokumente und Einstellungen\***\Desktop\HiJackThis204.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

http=127.0.0.1:6092
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital

Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Asz.Citavi.IEPicker.IEPickerButton - {609D670F-B735-4da7-AC6D-F3BD358E325E} -

C:\WINDOWS\system32\mscoree.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -

C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} -

C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -

C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital

Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhonostarTimer] C:\Programme\phonostar\ps_timer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Citavi Picker... - file://C:\Programme\Internet Explorer\PLUGINS\Citavi

Picker\ShowContextMenu.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren -

res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programme\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programme\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Citavi Picker - {619D670F-B735-4da7-AC6D-F3BD358E325E} -

C:\WINDOWS\system32\mscoree.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} -

C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -

C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -

C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} -

C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft

Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} -

C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon -

{8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir

Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir

Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco

Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation -

C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. -

C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame

Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame

Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame

Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9229 bytes

kira 15.09.2010 20:10
1.
- verwendest Du kein Programm (mehr) von Norton?
- Deinstalliere unter `Start→ Systemsteuereung→ Ändern/Entfernen...`
Code:
LiveUpdate 1.90 (Symantec Corporation)
2.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ "Do a system scan only"→ Einträge auswählen→ Häckhen setzen→ "Fix checked" klicken→ PC neu aufstarten):
HijackThis erstellt ein Backup, Falls bei "Fixen" etwas schief geht, kann man unter "View the list of backups"- die Objekte wiederherstellen
Code:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6092
3.
→ besuche die Seite von virustotal und die Datei/en aus Codebox bitte prüfen lassen - inklusive Dateigröße und Name, MD5 und SHA1 auch mitkopieren:
→ Tipps für die Suche nach Dateien
Code:
C:\WINDOWS\system32\DRIVERS\redbook.sys                                                                                                                suspicious modification
C:\WINDOWS\system32\drivers\atapi.sys
C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\kxtdypow.sys

oder auch unter "drivers" :-> kxtdypow.sys
 
→ Klicke auf "Durchsuchen"
→ Suche die Datei auf deinem Rechner→ Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox)
→ "Senden der Datei" und Warte, bis der Scandurchlauf aller Virenscanner beendet ist
→ das Ergebnis wie Du es bekommst (NICHT AUSLASSEN!) da reinkoperen (inklusive <geprüfter Dateiname> + Dateigröße und Name, MD5 und SHA1)

** Beispiel - das zu postende Logfile von Virustotal soll so wie hier aussehen Also nicht auslassen, sondern wie Du es bekommst da reinkopieren!:
Code:
Datei <hier kommt die Dateiname> empfangen 2009.xx.xx xx:xx:xx (CET)
Antivirus        Version        letzte aktualisierung        Ergebnis
a-squared        4.0.0.73        2009.01.28        -
AhnLab-V3        5.0.0.2        2009.01.28        -
AntiVir        7.9.0.60        2009.01.28        -
Authentium        5.1.0.4        2009.01.27        -

...über 40 Virenscannern...also Geduld!!

Bergamo 19.09.2010 15:09
Hi

1. ok!

2. ok!

3. Hier:

Code:
  0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name:
redbook.sys
Submission date:
2010-09-19 13:41:46 (UTC)
Current status:
queued (#3) queued (#3) analysing finished
Result:
1/ 43 (2.3%)
       
VT Community

not reviewed
 Safety score: -
Compact
Print results
Antivirus        Version        Last Update        Result
AhnLab-V3        2010.09.19.00        2010.09.18        -
AntiVir        8.2.4.58        2010.09.18        -
Antiy-AVL        2.0.3.7        2010.09.19        -
Authentium        5.2.0.5        2010.09.18        -
Avast        4.8.1351.0        2010.09.19        -
Avast5        5.0.594.0        2010.09.19        -
AVG        9.0.0.851        2010.09.19        -
BitDefender        7.2        2010.09.19        -
CAT-QuickHeal        11.00        2010.09.18        -
ClamAV        0.96.2.0-git        2010.09.18        -
Comodo        6128        2010.09.19        -
DrWeb        5.0.2.03300        2010.09.19        -
Emsisoft        5.0.0.37        2010.09.19        -
eSafe        7.0.17.0        2010.09.17        -
eTrust-Vet        36.1.7862        2010.09.17        -
F-Prot        4.6.1.107        2010.09.18        -
F-Secure        9.0.15370.0        2010.09.19        -
Fortinet        4.1.143.0        2010.09.19        -
GData        21        2010.09.19        -
Ikarus        T3.1.1.88.0        2010.09.19        -
Jiangmin        13.0.900        2010.09.19        -
K7AntiVirus        9.63.2552        2010.09.18        -
Kaspersky        7.0.0.125        2010.09.19        -
McAfee        5.400.0.1158        2010.09.19        -
McAfee-GW-Edition        2010.1C        2010.09.18        Heuristic.LooksLike.Trojan.Patched.I
Microsoft        1.6201        2010.09.19        -
NOD32        5460        2010.09.18        -
Norman        6.06.06        2010.09.19        -
nProtect        2010-09-19.01        2010.09.19        -
Panda        10.0.2.7        2010.09.19        -
PCTools        7.0.3.5        2010.09.19        -
Prevx        3.0        2010.09.19        -
Rising        22.65.05.00        2010.09.18        -
Sophos        4.57.0        2010.09.19        -
Sunbelt        6895        2010.09.19        -
SUPERAntiSpyware        4.40.0.1006        2010.09.19        -
Symantec        20101.1.1.7        2010.09.19        -
TheHacker        6.7.0.0.024        2010.09.19        -
TrendMicro        9.120.0.1004        2010.09.19        -
TrendMicro-HouseCall        9.120.0.1004        2010.09.19        -
VBA32        3.12.14.0        2010.09.17        -
ViRobot        2010.9.18.4048        2010.09.19        -
VirusBuster        12.65.13.0        2010.09.18        -
Additional information
Show all
MD5  : ed761d453856f795a7fe056e42c36365
SHA1  : 82c58b8b38105047e85d62c1548c4a2b95de1805
SHA256: ef026585b33415d8fce94a9f27d7a4396c7c35c88e06a4cf0fea702401e8597a
ssdeep: 768:DPvM9HDkL0716NBg4bI8kyZN5GeLuAtbwGf+MhVxcs8Km5keq2ZX2PTYnGNWBcqH:DXNXtN
vq5Y0qtoKTITYC67HyhW
File size : 57728 bytes
First seen: 2009-06-17 14:02:37
Last seen : 2010-09-19 13:41:46
TrID:
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. Alle Rechte vorbehalten.
product......: Betriebssystem Microsoft_ Windows_
description..: Redbook-Audiofiltertreiber
original name: redbook.sys
internal name: redbook.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
packers (Kaspersky): PE_Patch
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0xB785
timedatestamp....: 0x4802539B (Sun Apr 13 18:40:27 2008)
machinetype......: 0x14c (I386)

[[ 9 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x380, 0x1A54, 0x1A80, 5.79, 2f65a6d172b863d55d0c18f356918438
.rdata, 0x1E00, 0x688, 0x700, 4.08, d375e5e27f10d144ce89d5bb516d71f7
.data, 0x2500, 0x440, 0x480, 5.97, c024cfa98213cf8eafa8cffd77e31069
PAGE, 0x2980, 0x8660, 0x8680, 5.75, 234e863353f14404d1d7ff8e1e81c3f7
PAGERW, 0xB000, 0x640, 0x680, 5.54, 9e6ba6ab04abc155e2b4bb36a0c33cbb
PAGECONS, 0xB680, 0xD0, 0x100, 5.11, e75c1b73974435fc7693ab6c07530a96
INIT, 0xB780, 0x7E0, 0x800, 5.38, 99ebe3d03b1d6afb12ac2c57daf413b2
.rsrc, 0xBF80, 0x157C, 0x1580, 3.48, 5052dc935af9c37aa97aa656686878ce
.reloc, 0xD500, 0xC14, 0xC80, 6.53, 107b2c1386b547601bd4fd107a4a826a

[[ 4 import(s) ]]
ntoskrnl.exe: RtlInitUnicodeString, IoGetDeviceInterfaces, wcslen, WmiQueryTraceInformation, IoWMIRegistrationControl, RtlCopyUnicodeString, ExAllocatePoolWithTag, IoGetDriverObjectExtension, IoAllocateDriverObjectExtension, IofCallDriver, IoDeleteDevice, IoDetachDevice, PsCreateSystemThread, KeInitializeSpinLock, IoInitializeRemoveLockEx, KeInitializeEvent, IoAttachDeviceToDeviceStack, IoCreateDevice, IoReleaseRemoveLockEx, KeSetEvent, KeWaitForSingleObject, IofCompleteRequest, IoAcquireRemoveLockEx, IoUnregisterPlugPlayNotification, IoReleaseRemoveLockAndWaitEx, IoRegisterPlugPlayNotification, ExfInterlockedInsertTailList, ZwCreateFile, ExfInterlockedRemoveHeadList, KeQueryTimeIncrement, KeTickCount, KeWaitForMultipleObjects, KeSetPriorityThread, KeGetCurrentThread, _alldiv, _allmul, IoReuseIrp, IoFreeMdl, IoFreeIrp, MmBuildMdlForNonPagedPool, IoAllocateMdl, IoAllocateIrp, KeClearEvent, IoBuildDeviceIoControlRequest, RtlQueryRegistryValues, ZwOpenKey, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, ZwCreateKey, _aulldiv, PoCallDriver, PoStartNextPowerIrp, IoInitializeIrp, KeBugCheckEx, ExFreePoolWithTag, ObReferenceObjectByHandle, ZwClose, ObfDereferenceObject, IoGetRelatedDeviceObject, WmiTraceMessage, IoAllocateErrorLogEntry, PsTerminateSystemThread, IoWriteErrorLogEntry
HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock
WMILIB.SYS: WmiCompleteRequest, WmiSystemControl
ks.sys: KsCreatePin, KsSynchronousIoControlDevice
Code:
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is malware.
File name:
atapi.sys
Submission date:
2010-09-19 13:57:56 (UTC)
Current status:
queued queued analysing finished
Result:
1/ 43 (2.3%)
       
VT Community

malware
 Safety score: 0.0%
Compact
Print results
Antivirus        Version        Last Update        Result
AhnLab-V3        2010.09.19.00        2010.09.18        -
AntiVir        8.2.4.58        2010.09.18        -
Antiy-AVL        2.0.3.7        2010.09.19        -
Authentium        5.2.0.5        2010.09.18        -
Avast        4.8.1351.0        2010.09.19        -
Avast5        5.0.594.0        2010.09.19        -
AVG        9.0.0.851        2010.09.19        -
BitDefender        7.2        2010.09.19        -
CAT-QuickHeal        11.00        2010.09.18        -
ClamAV        0.96.2.0-git        2010.09.18        -
Comodo        6130        2010.09.19        -
DrWeb        5.0.2.03300        2010.09.19        -
Emsisoft        5.0.0.37        2010.09.19        -
eSafe        7.0.17.0        2010.09.17        Win32.Rootkit
eTrust-Vet        36.1.7862        2010.09.17        -
F-Prot        4.6.1.107        2010.09.18        -
F-Secure        9.0.15370.0        2010.09.19        -
Fortinet        4.1.143.0        2010.09.19        -
GData        21        2010.09.19        -
Ikarus        T3.1.1.88.0        2010.09.19        -
Jiangmin        13.0.900        2010.09.19        -
K7AntiVirus        9.63.2552        2010.09.18        -
Kaspersky        7.0.0.125        2010.09.19        -
McAfee        5.400.0.1158        2010.09.19        -
McAfee-GW-Edition        2010.1C        2010.09.18        -
Microsoft        1.6201        2010.09.19        -
NOD32        5460        2010.09.18        -
Norman        6.06.06        2010.09.19        -
nProtect        2010-09-19.01        2010.09.19        -
Panda        10.0.2.7        2010.09.19        -
PCTools        7.0.3.5        2010.09.19        -
Prevx        3.0        2010.09.19        -
Rising        22.65.05.00        2010.09.18        -
Sophos        4.57.0        2010.09.19        -
Sunbelt        6895        2010.09.19        -
SUPERAntiSpyware        4.40.0.1006        2010.09.19        -
Symantec        20101.1.1.7        2010.09.19        -
TheHacker        6.7.0.0.024        2010.09.19        -
TrendMicro        9.120.0.1004        2010.09.19        -
TrendMicro-HouseCall        9.120.0.1004        2010.09.19        -
VBA32        3.12.14.0        2010.09.17        -
ViRobot        2010.9.18.4048        2010.09.19        -
VirusBuster        12.65.13.0        2010.09.18        -
Additional information
Show all
MD5  : 9f3a2f5aa6875c72bf062c712cfa2674
SHA1  : a719156e8ad67456556a02c34e762944234e7a44
SHA256: b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9
ssdeep: 1536:MwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1KbDD0uu:MQ+N7
4vkEZIxMohjsimBoDTRMBwFktZu
File size : 96512 bytes
First seen: 2009-01-14 22:53:16
Last seen : 2010-09-19 13:57:56
TrID:
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IDE/ATAPI Port Driver
original name: atapi.sys
internal name: atapi.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
packers (Kaspersky): PE_Patch
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x159F7
timedatestamp....: 0x4802539D (Sun Apr 13 18:40:29 2008)
machinetype......: 0x14c (I386)

[[ 9 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x380, 0x97BA, 0x9800, 6.45, 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE, 0x9B80, 0x18E8, 0x1900, 6.48, c74a833abd81cc5d037de168e055ad29
.rdata, 0xB480, 0xA64, 0xA80, 4.31, 8523651899e28819a14bf9415af25708
.data, 0xBF00, 0xD94, 0xE00, 0.45, 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN, 0xCD00, 0x157F, 0x1580, 6.20, dc4c309c4db9576daa752fdd125fccf9
PAGE, 0xE280, 0x61DA, 0x6200, 6.46, 40b83d4d552384e58a03517a98eb4863
INIT, 0x14480, 0x22BE, 0x2300, 6.47, 906462abc478368424ea462d5868d2e3
.rsrc, 0x16780, 0x3E0, 0x400, 3.36, 8fd2d82e745b289c28bc056d3a0d62ab
.reloc, 0x16B80, 0xD20, 0xD80, 6.39, ce2b0898cc0e40b618e5df9099f6be45

[[ 3 import(s) ]]
ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
WMILIB.SYS: WmiSystemControl, WmiCompleteRequest
Die dritte Datei konnte nicht mehr gefunden werden. Auch nicht unter drivers --> kxtdypow.sys

kira 20.09.2010 06:20
hi
  • Lade den TDSSKiller und entpacke das Archiv auf Deinen Desktop.
  • Vergewissere Dich, dass die TDSSKiller.exe direkt auf dem Desktop liegt (nicht in einem Ordner auf dem Desktop).
  • Starte die TDSSKiller.exe durch Doppelklick.
  • Nach Beendigung der Arbeit schlägt das Tool vor, das System neu zu starten.
    Bestätige das ggfs. mit Y(es).
    Beim Hochfahren des Systems führt der Treiber alle geplanten Operationen aus löscht sich danach.
  • Poste mir den Inhalt von C:\TDSSKiller<random>.txt hier in den Thread.
Hier findest Du eine ausführlichere Anleitung.

Bergamo 20.09.2010 22:11
hallo,

kurz zur Info:
Der IE und Messenger haben wieder eine Internetverbindung und Antivir lässt sich auch wieder updaten. Schon vor dem Scan mit TDSSKiller.

Hier noch das Ergebnis:

Code:
2010/09/20 22:55:11.0798        TDSS rootkit removing tool 2.4.2.1 Sep  7 2010 14:43:44
2010/09/20 22:55:11.0798        ================================================================================
2010/09/20 22:55:11.0798        SystemInfo:
2010/09/20 22:55:11.0798       
2010/09/20 22:55:11.0798        OS Version: 5.1.2600 ServicePack: 3.0
2010/09/20 22:55:11.0798        Product type: Workstation
2010/09/20 22:55:11.0798        ComputerName: ***
2010/09/20 22:55:11.0798        UserName: ***
2010/09/20 22:55:11.0798        Windows directory: C:\WINDOWS
2010/09/20 22:55:11.0798        System windows directory: C:\WINDOWS
2010/09/20 22:55:11.0798        Processor architecture: Intel x86
2010/09/20 22:55:11.0798        Number of processors: 1
2010/09/20 22:55:11.0798        Page size: 0x1000
2010/09/20 22:55:11.0798        Boot type: Normal boot
2010/09/20 22:55:11.0798        ================================================================================
2010/09/20 22:55:14.0392        Initialize success
2010/09/20 22:55:22.0693        ================================================================================
2010/09/20 22:55:22.0693        Scan started
2010/09/20 22:55:22.0693        Mode: Manual;
2010/09/20 22:55:22.0693        ================================================================================
2010/09/20 22:55:25.0387        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/09/20 22:55:25.0728        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2010/09/20 22:55:25.0988        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/09/20 22:55:26.0279        AFD            (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2010/09/20 22:55:26.0609        agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2010/09/20 22:55:27.0190        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/09/20 22:55:27.0560        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/09/20 22:55:27.0721        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/09/20 22:55:27.0951        ati2mtag        (5e3603e9fba29e01f5ffc108276b3005) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/09/20 22:55:28.0562        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/09/20 22:55:28.0692        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/09/20 22:55:28.0973        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2010/09/20 22:55:29.0313        avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2010/09/20 22:55:29.0643        avipbb          (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2010/09/20 22:55:29.0904        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/09/20 22:55:30.0184        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/09/20 22:55:30.0405        CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/09/20 22:55:30.0575        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/09/20 22:55:30.0635        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/09/20 22:55:30.0745        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/09/20 22:55:30.0855        CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2010/09/20 22:55:30.0945        Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2010/09/20 22:55:31.0045        CONAN          (52a4e2ad9349a837ad602dc97db305d4) C:\WINDOWS\system32\drivers\o2mmb.sys
2010/09/20 22:55:31.0166        CVirtA          (b5ecadf7708960f1818c7fa015f4c239) C:\WINDOWS\system32\DRIVERS\CVirtA.sys
2010/09/20 22:55:31.0266        CVPNDRVA        (465ced77e7c4f9d71b81ba600edafac1) C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
2010/09/20 22:55:31.0446        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/09/20 22:55:31.0566        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2010/09/20 22:55:31.0787        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2010/09/20 22:55:31.0847        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/09/20 22:55:31.0937        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/09/20 22:55:32.0027        DNE            (86d52c32a308f84bbc626bff7c1fb710) C:\WINDOWS\system32\DRIVERS\dne2000.sys
2010/09/20 22:55:32.0187        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/09/20 22:55:32.0297        ElbyCDIO        (178cc9403816c082d22a1d47fa1f9c85) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
2010/09/20 22:55:32.0367        ElbyDelay      (df9957db3bfe5136aad3c2c101806c98) C:\WINDOWS\system32\Drivers\ElbyDelay.sys
2010/09/20 22:55:32.0488        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/09/20 22:55:32.0568        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2010/09/20 22:55:32.0688        FilterService  (f83c0fd028dd37be4a337b138eba6b7b) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
2010/09/20 22:55:32.0778        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2010/09/20 22:55:32.0848        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/09/20 22:55:32.0938        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/09/20 22:55:33.0038        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/09/20 22:55:33.0139        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/09/20 22:55:33.0219        GEARAspiWDM    (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2010/09/20 22:55:33.0299        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/09/20 22:55:33.0369        hidusb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/09/20 22:55:33.0539        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/09/20 22:55:33.0749        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/09/20 22:55:33.0860        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/09/20 22:55:34.0010        IntelIde        (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/09/20 22:55:34.0090        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/09/20 22:55:34.0160        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/09/20 22:55:34.0240        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/09/20 22:55:34.0340        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/09/20 22:55:34.0400        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/09/20 22:55:34.0500        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/09/20 22:55:34.0581        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/09/20 22:55:34.0641        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/09/20 22:55:34.0721        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/09/20 22:55:34.0781        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/09/20 22:55:34.0861        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/09/20 22:55:35.0011        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/09/20 22:55:35.0332        LVcKap          (9ce361764c5dd5fa5506510fe5d2297b) C:\WINDOWS\system32\DRIVERS\LVcKap.sys
2010/09/20 22:55:35.0502        LVPr2Mon        (94d03b31f36bb362fa5713470fcf1c79) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
2010/09/20 22:55:35.0612        LVRS            (a198cd8a1c813d9ceba29a29d45fc94c) C:\WINDOWS\system32\DRIVERS\lvrs.sys
2010/09/20 22:55:35.0692        LVUSBSta        (8b79a50360fc31df6b7b979b686b4aa2) C:\WINDOWS\system32\drivers\LVUSBSta.sys
2010/09/20 22:55:35.0943        LVUVC          (5c20c4be679842cbee729b0cff5928bd) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
2010/09/20 22:55:36.0343        MbxStby        (96330f694bd665b3a0f814ef6b1bbff8) C:\WINDOWS\system32\drivers\MbxStby.sys
2010/09/20 22:55:36.0433        MHNDRV          (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
2010/09/20 22:55:36.0543        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/09/20 22:55:36.0634        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2010/09/20 22:55:36.0794        MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/09/20 22:55:37.0234        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/09/20 22:55:37.0755        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/09/20 22:55:38.0036        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/09/20 22:55:38.0296        MPE            (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys
2010/09/20 22:55:38.0707        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/09/20 22:55:39.0157        MRxSmb          (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/09/20 22:55:39.0878        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/09/20 22:55:40.0028        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/09/20 22:55:40.0099        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/09/20 22:55:40.0199        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/09/20 22:55:40.0299        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/09/20 22:55:40.0339        MSTEE          (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/09/20 22:55:40.0459        Mtlmnt5        (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
2010/09/20 22:55:40.0599        Mtlstrm        (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
2010/09/20 22:55:40.0860        Mup            (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/09/20 22:55:40.0940        NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/09/20 22:55:41.0040        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2010/09/20 22:55:41.0100        NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/09/20 22:55:41.0180        NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/09/20 22:55:41.0230        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/09/20 22:55:41.0290        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/09/20 22:55:41.0360        NDProxy        (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/09/20 22:55:41.0440        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/09/20 22:55:41.0571        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/09/20 22:55:41.0701        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/09/20 22:55:41.0771        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/09/20 22:55:41.0871        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/09/20 22:55:41.0991        NtMtlFax        (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
2010/09/20 22:55:42.0091        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/09/20 22:55:42.0171        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/09/20 22:55:42.0352        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/09/20 22:55:42.0462        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/09/20 22:55:42.0532        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2010/09/20 22:55:42.0622        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/09/20 22:55:42.0692        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/09/20 22:55:42.0762        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/09/20 22:55:42.0842        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/09/20 22:55:42.0943        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2010/09/20 22:55:43.0173        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/09/20 22:55:43.0233        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/09/20 22:55:43.0283        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/09/20 22:55:43.0383        PxHelp20        (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/09/20 22:55:43.0584        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/09/20 22:55:43.0674        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/09/20 22:55:43.0764        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/09/20 22:55:43.0844        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/09/20 22:55:43.0944        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/09/20 22:55:44.0044        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/09/20 22:55:44.0094        rdpdr          (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/09/20 22:55:44.0164        RDPWD          (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/09/20 22:55:44.0234        RecAgent        (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
2010/09/20 22:55:44.0295        redbook        (3476891380a2fa414f495348ace7ac31) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/09/20 22:55:44.0325        Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\redbook.sys. Real md5: 3476891380a2fa414f495348ace7ac31, Fake md5: ed761d453856f795a7fe056e42c36365
2010/09/20 22:55:44.0335        redbook - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/09/20 22:55:44.0405        RTL8023xp      (e9877aa069dc11b03dbd1d33b8b2a3ca) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
2010/09/20 22:55:44.0475        rtl8139        (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2010/09/20 22:55:44.0595        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/09/20 22:55:44.0715        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2010/09/20 22:55:44.0825        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
2010/09/20 22:55:44.0976        SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/09/20 22:55:45.0066        Slntamr        (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
2010/09/20 22:55:45.0166        SlNtHal        (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
2010/09/20 22:55:45.0256        SlWdmSup        (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
2010/09/20 22:55:45.0366        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/09/20 22:55:45.0466        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/09/20 22:55:45.0566        Srv            (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/09/20 22:55:45.0677        ssmdrv          (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2010/09/20 22:55:45.0737        streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/09/20 22:55:45.0857        STV673          (a6fd4e8085d6b7675a120a7c9fec3560) C:\WINDOWS\system32\drivers\STV673.sys
2010/09/20 22:55:45.0897        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/09/20 22:55:45.0997        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/09/20 22:55:46.0167        SynTP          (065d6efc03486c2039b8c2b4c56e6edb) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2010/09/20 22:55:46.0257        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/09/20 22:55:46.0337        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/09/20 22:55:46.0438        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/09/20 22:55:46.0508        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/09/20 22:55:46.0588        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/09/20 22:55:46.0698        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/09/20 22:55:46.0818        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/09/20 22:55:46.0958        USB28xxBGA      (d163c2fa32265aacbb1b7eaf613fbdd4) C:\WINDOWS\system32\DRIVERS\emBDA.sys
2010/09/20 22:55:47.0049        USB28xxOEM      (2e7add4f70c336e4e66f68567fef01d5) C:\WINDOWS\system32\DRIVERS\emOEM.sys
2010/09/20 22:55:47.0189        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/09/20 22:55:47.0259        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/09/20 22:55:47.0339        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/09/20 22:55:47.0419        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/09/20 22:55:47.0489        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/09/20 22:55:47.0589        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/09/20 22:55:47.0689        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/09/20 22:55:47.0760        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/09/20 22:55:47.0830        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/09/20 22:55:47.0990        VIAudio        (3fb54164fc7412693895bb9924399456) C:\WINDOWS\system32\drivers\vinyl97.sys
2010/09/20 22:55:48.0050        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/09/20 22:55:48.0130        vsdatant        (27b3dd12a19eec50220df15b64913dda) C:\WINDOWS\system32\vsdatant.sys
2010/09/20 22:55:48.0360        w22n51          (b6cb2cce557ce57c72c3d31e701e6e39) C:\WINDOWS\system32\DRIVERS\w22n51.sys
2010/09/20 22:55:48.0661        w29n51          (f0608f3b5b6d16f4870e867f9d069b6b) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2010/09/20 22:55:48.0911        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/09/20 22:55:49.0011        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/09/20 22:55:49.0182        WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/09/20 22:55:49.0292        ================================================================================
2010/09/20 22:55:49.0292        Scan finished
2010/09/20 22:55:49.0292        ================================================================================
2010/09/20 22:55:49.0312        Detected object count: 1
2010/09/20 22:56:14.0308        redbook        (3476891380a2fa414f495348ace7ac31) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/09/20 22:56:14.0308        Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\redbook.sys. Real md5: 3476891380a2fa414f495348ace7ac31, Fake md5: ed761d453856f795a7fe056e42c36365
2010/09/20 22:56:16.0461        Backup copy found, using it..
2010/09/20 22:56:16.0521        C:\WINDOWS\system32\DRIVERS\redbook.sys - will be cured after reboot
2010/09/20 22:56:16.0521        Rootkit.Win32.TDSS.tdl3(redbook) - User select action: Cure
2010/09/20 22:56:39.0374        Deinitialize success

kira 22.09.2010 06:36
Scan mit SystemLook

Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.

Download Mirror #1 - Download Mirror #2
  • Doppelklick auf die SystemLook.exe, um das Tool zu starten.
    Vista-User mit Rechtsklick und als Administrator starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    :filefind
    redbook.sys
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Bergamo 22.09.2010 18:33
Hi,
hier die Auswertung

Code:
SystemLook 04.09.10 by jpshortstuff
Log created at 19:15 on 22/09/2010 by ***
Administrator - Elevation successful

========== filefind ==========

Searching for "redbook.sys"
C:\WINDOWS\$NtServicePackUninstall$\redbook.sys        -----c- 57600 bytes        [21:40 26/08/2008]        [23:40 03/08/2004] AA56702E230860565CB8D43680F57F33
C:\WINDOWS\ServicePackFiles\i386\redbook.sys        ------- 57728 bytes        [21:23 26/08/2008]        [01:52 14/04/2008] ED761D453856F795A7FE056E42C36365
C:\WINDOWS\system32\drivers\redbook.sys        --a---- 57728 bytes        [13:42 12/02/2006]        [20:58 20/09/2010] ED761D453856F795A7FE056E42C36365

-= EOF =-

kira 22.09.2010 21:07
hi

Ok die Datei ist in Ordnung:)

1.
Deine Javaversion ist nicht aktuell!
Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen:
→ Systemsteuerung → Software → deinstallieren...
→ Rechner neu aufstarten
→ Downloade nun die Offline-Version von Java Version 6 Update 21 von Oracle herunter
Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)!

2.
Adobe Reader aktualisieren :
Adobe Reader
Oder: Adobe starten-> gehe auf "Hilfe"-> "Nach Update suchen..."

3.
alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren
**Der Temp Ordner,ist für temporäre Dateien,also der Inhalt kann man ohne weiteres löschen.- Dateien, die noch in Benutzung sind, nicht löschbar.
**Lösche nur den Inhalt der Ordner, nicht die Ordner selbst!
  • `Start → ausführen` "cleanmgr" reinschreiben (ohne "") → "ok" - die Temporary Files, Temporary Internet Files, und der Papierkorb (Recycle Bin) müssen geleert werden→ "Ok"
  • `Start → ausführen` → %temp% reinschreiben (ohne "")→ "Ok" - - Ordnerinhalt überall markieren und löschen
  • für jedes Benutzerkonto bitte durchführen
  • anschließend den Papierkorb leeren

4.
reinige dein System mit Ccleaner:
  • "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

5.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
>>Du sollst das Programm nicht installieren, sondern dein System nur online scannen<<
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.► [Sicherheit] Autorun Funktion für mehr Sicherheit auf allen Laufwerken deaktivieren /Avira Support Forum
Führe dann einen Komplett-Systemcheck mit Nod32 durch
- folgendes bitte anhaken > "Remove found threads" und "Scan archives"
- die Scanergebnis als *.txt Dateien speichern)
- meistens "C:\Programme\Eset\EsetOnlineScanner\log.txt"
- (ESET Online Scanner
Vor dem Scan Einstellungen im Internet Explorer:
- "Extras→ Internetoptionen→ Sicherheit":
- alles auf Standardstufe stellen
- Active X erlauben

7.
poste erneut - nach der vorgenommenen Reinigungsaktion:
TrendMicro™ HijackThis™ -Logfile - Keine offenen Fenster, solang bis HijackThis läuft!!

** Wie ist den aktuellen Zustand des Rechners?

Bergamo 25.09.2010 09:48
Hi,
alles erledigt!
1.
2.
3.
4.
ok

5.
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/23/2010 at 07:20 PM

Application Version : 4.43.1000

Core Rules Database Version : 5565
Trace Rules Database Version: 3377

Scan type      : Complete Scan
Total Scan Time : 01:01:12

Memory items scanned      : 530
Memory threats detected  : 0
Registry items scanned    : 8525
Registry threats detected : 4
File items scanned        : 22728
File threats detected    : 8

Trojan.NewDotNet
        HKU\S-1-5-21-220523388-1935655697-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
        HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
        HKU\.DEFAULT\Software\New.net
        HKU\S-1-5-18\Software\New.net

Rogue.AntiMalwareDoctor
        C:\Dokumente und Einstellungen\***\Anwendungsdaten\6DF4266474A69BF700722E1DC89FC357

Adware.Tracking Cookie
        .atdmt.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\wtv1hb53.default\cookies.sqlite ]
        .atdmt.com [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\wtv1hb53.default\cookies.sqlite ]
        .doubleclick.net [ C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\wtv1hb53.default\cookies.sqlite ]
        C:\Dokumente und Einstellungen\NetworkService\Cookies\system@bizzclick[1].txt

Trojan.Agent/Gen
        C:\DOKUMENTE UND EINSTELLUNGEN\***\DESKTOP\IEXPLORE.EXE.COM

Trojan.Agent/Gen-Krpytik
        C:\MINIBHKW-PLAN_AUSBILDUNG\BHKWPLAN.DLL
        C:\PROGRAMME\MINIBHKW\BHKWPLAN.DLL
6.
Code:
C:\Dokumente und Einstellungen\***\Anwendungsdaten\phonostar-Player\update2.exe        Variante von Win32/Adware.ADON Anwendung        gelöscht - in Quarantäne kopiert
C:\Dokumente und Einstellungen\***\Desktop\Neuer Ordner (2)\FreeStudio.exe        Win32/Adware.ADON Anwendung        gelöscht - in Quarantäne kopiert
C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp\jar_cache2026134757273975450.tmp        Variante von Java/Exploit.Agent.NAC Trojaner        gelöscht - in Quarantäne kopiert
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\46\1277f56e-6e87628f        Mehrere Bedrohungen        gelöscht - in Quarantäne kopiert
7.
Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:33:03, on 25.09.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Logitech\QuickCam\Quickcam.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\QuickTime\QTTask.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\phonostar\ps_timer.exe
C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe
C:\WINDOWS\system32\slrundll.exe
C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
C:\Dokumente und Einstellungen\***\Desktop\HiJackThis204.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Asz.Citavi.IEPicker.IEPickerButton - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System\dumprep.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhonostarTimer] C:\Programme\phonostar\ps_timer.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Citavi Picker... - file://C:\Programme\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Citavi Picker - {619D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9140 bytes

kira 26.09.2010 06:56
Wie ist den aktuellen Zustand des Rechners?

Bergamo 26.09.2010 19:25
Hi,
der Zustand ist gut. Ein bisschen langsam, aber ansonsten alles ok.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:04 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131